Slot: flag_history

The Connection Flag History summarizes events in a network connection. For

example flags ShAD representing SYN, SYN/ACK, ACK and Data

exchange.

URI: ocsf:flag_history Alias: flag_history

Applicable Classes

Name	Description	Modifies Slot
NetworkConnectionInfo	The Network Connection Information object describes characteristics of an OSI	no

Properties

Type and Range

Property	Value
Range	String
Domain Of	NetworkConnectionInfo

Cardinality and Requirements

Property	Value

Aliases

• Connection Flag History

See Also

• https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is

Notes

• Zeek History — https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/ocsf

Mappings

Mapping Type	Mapped Value
self	ocsf:flag_history
native	ocsf:flag_history

LinkML Source

name: flag_history
description: 'The Connection Flag History summarizes events in a network connection.
  For

  example flags <code> ShAD </code> representing SYN, SYN/ACK, ACK and Data

  exchange.'
notes:
- 'Zeek History —

  https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is'
from_schema: https://w3id.org/lmodel/ocsf
see_also:
- https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is
aliases:
- Connection Flag History
rank: 1000
alias: flag_history
domain_of:
- NetworkConnectionInfo
range: string